A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically gene

Summary

A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.

Timeline

1. Mar 27, 2019, 1:48 PM UTCCVE published
2. May 2, 2019Public exploit on Exploit-DB

   EDB-46785

3. Aug 4, 2024, 7:54 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Rails https://github.com/rails/rails

  5.2.2.1, 6.0.0.beta3

• railtiesRubyGems

  From 5.2.0 · fixed in 5.2.2.1

References 19